EV ChitChat

Private-beta policy

Privacy Policy

EV ChitChat is built by BuildingRome LLC as a focused, owner-authorized interface between Amazon Alexa and Tesla's official Fleet API. We minimize collection, keep vehicle credentials out of browser-readable storage, and do not use personal or vehicle data for advertising.

Who operates EV ChitChat

EV ChitChat is operated by BuildingRome LLC. Privacy questions and requests may be sent to projects@buildingrome.dev.

Scope

This policy applies to the EV ChitChat website, account experience, private beta, and EV ChitChat Alexa Custom Skill. Amazon, Google, Tesla, and other providers process information under their own policies when you use their services.

Information we process

Account and authentication

  • A Firebase user identifier used to distinguish your EV ChitChat account.
  • Google and Firebase Authentication may process your Google account identifier, email address, IP address, user agent, and security information to authenticate you and prevent abuse.
  • Sign-in happens through a Google page in your browser (a top-level redirect, never a pop-up). When the server-side Google sign-in path is used, EV ChitChat receives a Google ID token, verifies its issuer, audience, and single-use nonce, uses it once to establish the Firebase user, and discards it. A ten-minute, single-use sign-in state record is stored server-side during that flow.
  • EV ChitChat keeps only the Firebase user identifier in its server session and application database. It does not copy your name, email address, or Google profile into its database.

Alexa linking and requests

  • An Amazon-assigned Alexa user identifier in each structured request, plus hashed EV ChitChat account-linking authorization/token records associated with your internal account ID.
  • During linking, the Alexa OAuth request parameters (client, redirect target, state, and optional PKCE challenge) are held in a ten-minute, single-use, server-private record while you sign in with Google, then bound to your internal account ID when linking completes.
  • If the one-time code fallback is used instead, the same record stores a hash of the displayed code and a hash of an opaque browser polling token; your account ID is added only after you approve the code while signed in.
  • Skill request identifiers, timestamps, requested intent, and normalized outcome.
  • We do not request or store Alexa voice recordings. Amazon converts speech to a structured skill request before EV ChitChat receives it.

Subscription and in-skill purchases

EV ChitChat offers in-skill purchases through Amazon. Amazon processes all payments, renewals, cancellations, refunds, and tax under its own terms and privacy policy. EV ChitChat does not receive or store your payment method or billing details.

To determine whether your account is entitled to paid features, EV ChitChat queries Amazon's Monetization API using a short-lived token included in each Alexa request. The result (entitled or not) is cached in your account record for up to five minutes to reduce latency. A server-side override field (plan) exists for private-beta accounts that were permanently granted access before the subscription launched. Neither field is readable by browser clients.

Tesla authorization and vehicle information

  • Tesla OAuth authorization tokens, granted scopes, account region, and connection status. Refresh tokens and short-lived access tokens are encrypted before persistence.
  • Authorized vehicle identifiers, a user-provided or Tesla-provided vehicle label, virtual-key pairing status, and the selected default vehicle.
  • Live vehicle status read from Tesla only when you ask, and only from the charge, climate, and vehicle-state categories: battery level, estimated range, charging state and time to full, charging current, charge limit, plug state, lock state, cabin and outside temperature, climate on/off, tire pressures and warnings, software-update availability, and odometer. These values are spoken or shown and then discarded; they are not stored, except the virtual-key pairing status noted above.
  • EV ChitChat never requests Tesla's location data category, so vehicle position, heading, speed, and trip information are never received.
  • The default vehicle preference required to route your requests.

Beta access requests

If you request beta access on the website, we store the name and email address you enter, with the time of the request, and email them to the operator so we can send an invitation. We use them only to manage beta invitations and delete them on request or when the beta ends.

Website analytics

The public website uses Vercel Web Analytics and Speed Insights, which are cookieless and collect aggregated page views, referrers, device and browser category, country, and page performance timings. They do not receive account identifiers, vehicle information, or the contents of account pages. We do not use advertising trackers.

Operations and security

Our hosting providers may process IP addresses and request metadata to deliver and protect the service. We may retain opaque correlation IDs, request type, time, latency, broad error category, and security events. We prohibit tokens, OAuth codes, full VINs, locations, authorization headers, private keys, and raw Tesla responses from application logs.

Information intentionally excluded

EV ChitChat does not plan to collect or retain:

  • Tesla or Google passwords.
  • Precise vehicle location, location history, driving history, or trip history.
  • Continuous vehicle telemetry or driver-behavior profiles.
  • Contacts, unrelated Tesla profile information, or advertising identifiers.
  • Alexa audio recordings.
  • Payment card or banking information.

How we use information

We use information only to:

  • Authenticate users and link an Alexa request to the correct account.
  • Maintain an owner-authorized Tesla connection and selected vehicle.
  • Answer a requested vehicle-status question, or perform a requested allowlisted command such as starting cabin climate.
  • Determine whether an account is entitled to paid features via Amazon's Monetization API.
  • Prevent replay, duplicate commands, unauthorized access, abuse, and unexpected cost.
  • Diagnose failures, maintain reliability, comply with law, and honor user requests.

We do not sell personal information, share it for cross-context behavioral advertising, serve advertising, or use vehicle information to build marketing, insurance, credit, or driver-scoring profiles.

Where information is processed

We use service providers only for necessary application functions:

  • Amazon processes Alexa interactions, delivers structured requests to the skill, and manages in-skill subscription billing, renewals, cancellations, refunds, and tax.
  • Tesla authorizes access and processes requested vehicle data and commands.
  • Google Firebase provides authentication and server-private database services.
  • Google Cloud provides isolated command signing and secret management.
  • Vercel hosts the public web application and server routes.

These providers may process data in the United States and other locations where they operate, subject to their terms and data-protection commitments. We do not disclose user or vehicle data to unrelated data brokers.

Retention

  • Account and preference records remain until deletion or until no longer needed to provide the account.
  • Tesla tokens and vehicle records remain while the EV ChitChat connection is active and are deleted after EV ChitChat disconnect or account deletion. Tesla-side revocation makes the credential unusable but may require a later EV ChitChat cleanup.
  • OAuth and sign-in state, Alexa linking requests, Alexa access tokens, and duplicate-request records are short-lived.
  • Google sign-in state and Alexa linking requests (including one-time codes) expire after ten minutes and are deleted when successfully completed; expired records are rejected immediately even if scheduled database cleanup has not run yet.
  • Alexa authorization codes expire after five minutes, access tokens after one hour, rotating link refresh records after no more than 180 days, and command duplicate-prevention records after seven days.
  • Daily fair-use and abuse counters store a hashed identifier and a count, never request contents, and expire within days.
  • Security and operational events are retained only for a documented, limited period based on investigation, reliability, and legal needs.

Concrete production retention periods and automated deletion tests are release requirements before access expands beyond the private beta.

Security

Implemented controls include data minimization, HTTPS, verified Firebase server sessions, host-only HttpOnly cookies, deny-all browser database rules, encrypted Tesla token and VIN storage, an isolated command-signing key, Alexa request verification, a narrow command allowlist, recent authentication for account deletion, an emergency command-disable switch, transactional Tesla token rotation, and bounded network calls without automatic command retry. Broader unattended use additionally requires production failure testing and disable drills. No security system can guarantee absolute protection, and we do not guarantee that the service or any stored information will be secure, available, or free of error. You use EV ChitChat at your own risk, as described in our Terms of Use. See our Security Overview for implemented and planned safeguards.

Your choices and rights

The account experience lets you view connection state, change your selected vehicle, reconnect, disconnect Tesla, and delete your EV ChitChat account and stored application data. You can also revoke Tesla access through Tesla and disable the skill through Amazon Alexa.

You may request access, correction, deletion, or a copy of applicable information by emailing projects@buildingrome.dev. We may need to verify your identity and authority over the account. Where California privacy law applies, eligible users may also have rights to know, correct, delete, limit certain uses, opt out of sale or sharing, and receive equal service for exercising those rights. EV ChitChat does not currently sell or share personal information for behavioral advertising.

Children

EV ChitChat is not directed to children and is intended only for adults who are authorized to use the connected vehicle and third-party accounts. We do not knowingly collect personal information from children.

Policy changes

We will update the date below and provide additional notice when a material change affects how information is collected, used, or shared. Expanding Tesla scopes or adding a new data use requires renewed notice and, where required, consent.

Contact

BuildingRome LLC
projects@buildingrome.dev

Effective for private beta · Updated September 4, 2026